CVE-2020-7599

CVE-2020-7599 affects the Gradle plugin com.gradle.plugin-publish prior to 0.11.0. When a plugin is published with Gradle running at --info, the Gradle Logger may expose an AWS pre-signed URL in build logs. If such logs are publicly accessible, an attacker could leverage the URL to replace a rece...

Insertion of Sensitive Information into Log File

Overview com.gradle.plugin-publish:com.gradle.plugin-publish.gradle.plugin is a plugin that publishes plugins to the Gradle Plugin Portal. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File. When a plugin author publishes a Gradle plugin while...

Akamai Delivers Fast Deployment and Edge Computing for Developers With March 2020 Release

With each iteration, Akamai moves nearer to our goal of enabling elite performance by the development teams that depend on Akamai for delivering reliable and highly performant experiences to their customers. The March 2020 release empowers teams to develop at the Akamai edge with even greater...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Arbitrary File Read when Moving an Issue Path Traversal in NPM Package Registry SSRF on Project Import External Users Can Create Personal Snippet Triggers Decription Can be Updated by Other Maintainers in Project Information Disclosure on Confidential Issues Moved to Private...

What can Application Security Testing add to DevOps programs?

The adoption of DevOps practices by organizations to shorten the standard development lifecycle has put new pressure on security teams to keep up with the pace of development within CI/CD pipelines. In order to accomplish this, security teams need to provide better security insights to developers...

CVE-2019-13003

CVE-2019-13003 affects GitLab Community and Enterprise Edition prior to 12.0.3. A parser used by GitLab CI is vulnerable to a resource-exhaustion attack, allowing uncontrolled resource consumption (network exposure, low attack complexity). The documented remediation is to upgrade to GitLab 12.0.3...

CVE-2020-2157

Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...

CVE-2020-2157

Jenkins Skytap Cloud CI Plugin 2.07 and earlier transmits configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure...

CVE-2020-2157

CVE-2020-2157 affects Jenkins Skytap Cloud CI Plugin, versions 2.07 and earlier. The underlying issue is that credentials are transmitted in plain text as part of job configuration forms, while stored encrypted on disk in config.xml. This can lead to exposure, e.g., to users with Extended Read pe...

PT-2020-15375 · Jenkins · Jenkins Skytap Cloud Ci Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Skytap Cloud CI Plugin versions 2.07 and earlier Description: The issue concerns the transmission of configured credentials in plain text as part of job configuration forms, potentially resulting in their exposure. The credentials are...

GitLab: SSRF into Shared Runner, by replacing dockerd with malicious server in Executor

Note I've assigned the severity HIGH and submitted this report based on previously disclosed blind SSRF bugs that were previously disclosed. https://hackerone.com/reports/398799 If that's not correct, please adjust or let me know if you require more immediate impact on users in order to consider...

What are the benefits of SAST testing in CI/CD pipelines?

Static application security testing SAST is traditionally used in software development lifecycles both early on in the process and often to "white box" test all files containing source code. Integrating SAST into modern CI/CD pipelines allows developers to continuously monitor their code, providi...

Aircrack-ng 1.6 - Complete Suite Of Tools To Assess WiFi Network Security

Aircrack-ng is a complete suite of tools to assess WiFi network security. It focuses on different areas of WiFi security: Monitoring: Packet capture and export of data to text files for further processing by third party tools. Attacking: Replay attacks, deauthentication, fake access points and...

cork (>=0.1.0 <=0.2.0), dvc (>=0.8.2 <=0.8.6) +12 more potentially affected by CVE-2019-16784 via pyinstaller (>=3.0.0 <=3.5.0)

pyinstaller PYPI version =3.0.0, =0.1.0, =0.8.2, =1.0.0.dev0, =2019.6.5, =0.1.22, =0.9.94, =0.0.1, =0.4.0, =0.1.0, =1.0.1, =0.2.0, =0.7.1 Source cves: CVE-2019-16784 Source advisory: OSV:GHSA-7FCJ-PQ9J-WH2R...

Managing Web Application Security

Web application scanners using dynamic application security testing DAST methods are ideal at identifying common vulnerabilities such as cross-site scripting, SQL injection, command execution and more. When used in conjunction with whitebox static application security testing SAST results that...

huskyCI - Performing Security Tests Inside Your CI

huskyCI is an open-source tool that performs security tests inside CI pipelines of multiple projects and centralizes all results into a database for further analysis and metrics. How does it work? The main goal of this project is to help development teams improve the quality of their code by...

Automatic API Attack Tool - Customizable API Attack Tool Takes An API Specification As An Input, Generates And Runs Attacks That Are Based On It As An Output

Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API specification. Each endpoint is...

CVE-2019-15589

An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...

CVE-2019-15589

An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...

Improper access control

An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...